CVE-2026-34280: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. in Oracle Corporation PeopleSoft Enterprise HCM Human Resources
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Manager). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
AI Analysis
Technical Summary
This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2 in the Job Profile Manager component. It permits a high privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data or gaining complete access to all accessible data within the affected PeopleSoft environment. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is listed in Oracle's April 2026 Critical Patch Update advisory, which addresses numerous security issues across Oracle products, but the advisory does not explicitly confirm a patch for this specific CVE. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible through PeopleSoft Enterprise HCM Human Resources. This compromises confidentiality and integrity of sensitive HR data. There is no reported impact on system availability. The vulnerability requires a high privileged attacker with network access via HTTP, limiting the attack surface to users with elevated privileges.
Mitigation Recommendations
Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Since the vendor advisory does not explicitly confirm the patch status for this specific vulnerability, organizations should verify patch availability and applicability via the official Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Maintaining up-to-date patches is critical as Oracle reports ongoing attempts to exploit vulnerabilities for which patches exist. No alternative mitigations or workarounds are specified by the vendor.
CVE-2026-34280: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. in Oracle Corporation PeopleSoft Enterprise HCM Human Resources
Description
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Manager). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2 in the Job Profile Manager component. It permits a high privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data or gaining complete access to all accessible data within the affected PeopleSoft environment. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is listed in Oracle's April 2026 Critical Patch Update advisory, which addresses numerous security issues across Oracle products, but the advisory does not explicitly confirm a patch for this specific CVE. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible through PeopleSoft Enterprise HCM Human Resources. This compromises confidentiality and integrity of sensitive HR data. There is no reported impact on system availability. The vulnerability requires a high privileged attacker with network access via HTTP, limiting the attack surface to users with elevated privileges.
Mitigation Recommendations
Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Since the vendor advisory does not explicitly confirm the patch status for this specific vulnerability, organizations should verify patch availability and applicability via the official Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Maintaining up-to-date patches is critical as Oracle reports ongoing attempts to exploit vulnerabilities for which patches exist. No alternative mitigations or workarounds are specified by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-03-26T19:48:45.675Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpuapr2026.html","vendor":"Oracle"}]
Threat ID: 69e7e5a219fe3cd2cdf9f7c6
Added to database: 4/21/2026, 9:01:22 PM
Last enriched: 4/21/2026, 10:02:51 PM
Last updated: 4/22/2026, 7:30:54 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.